CVE-2024-57004

Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email attachment, leading to the triggering of the XSS by visiting the SENT session.

References

Affected packages

Git / github.com/roundcube/roundcubemail

Affected ranges

Type

GIT

Repo

https://github.com/roundcube/roundcubemail

Events

Introduced

Last affected

5504a7ccb91cebbbf59fc09606c30f977df9ebec

Fixed

5504a7ccb91cebbbf59fc09606c30f977df9ebec

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.6.9"
        }
    ]
}

Affected versions

1.*

1.1-beta

1.1-rc

1.1.0

1.2-beta

1.2-rc

1.3-beta

1.4-beta

1.4-rc1

1.4-rc2

1.5-beta

1.5-rc

1.6-beta

1.6-rc

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.6.7

1.6.8

v0.*

v0.1-beta2

v1.*

v1.0-beta

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-57004.json"